Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 19:11

General

  • Target

    69daf2790ceb24aee42cf84769711a86d6fdc8d154c02f270690cb78db16c883.exe

  • Size

    478KB

  • MD5

    c985ba4b859c890f3048153634c9e437

  • SHA1

    51492634461d3045635397dc24251b7eb9bc0f44

  • SHA256

    69daf2790ceb24aee42cf84769711a86d6fdc8d154c02f270690cb78db16c883

  • SHA512

    4fd5ca114f93a53bad4268f639504120b6701141ac5be0ac027195ead8588ad04e9460143a51a098ac73987b3eb5986808419a053eecbf6b089a8afaf50e292d

  • SSDEEP

    12288:CMrNy90rKYQ1Vxoq4aI692wFfvTFnKcTbB6:ryoKFWqFLBKcg

Malware Config

Extracted

Family

redline

Botnet

divan

C2

217.196.96.102:4132

Attributes
  • auth_value

    b414986bebd7f5a3ec9aee0341b8e769

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69daf2790ceb24aee42cf84769711a86d6fdc8d154c02f270690cb78db16c883.exe
    "C:\Users\Admin\AppData\Local\Temp\69daf2790ceb24aee42cf84769711a86d6fdc8d154c02f270690cb78db16c883.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4054976.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4054976.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7002066.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7002066.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:652
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8054180.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8054180.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1512
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4952

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4054976.exe

          Filesize

          307KB

          MD5

          6d15e00817aa20f7bf8f3541e8433ef8

          SHA1

          094621e968a28200b92530e529ed0465538a8898

          SHA256

          e45f45d2f0de02960286060a317b613de93644b28a39b6dce8542bc305db91db

          SHA512

          57c36eb8278f980b3e34a11d5379cf005bae1bae35039a3ec2bb6c0977ba5358868fd9766073e2a30ee05661d88fad0285682192123a030e2079c3209447f4a2

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k7002066.exe

          Filesize

          182KB

          MD5

          19a88f76160979bf1b4e0142c16e252f

          SHA1

          c48d549ef2248795e2921790e209ff4d53354c5b

          SHA256

          6ffc768ddae33b68433997d71f8e32804942e3a2d4f19bebe3553b0c9ce08b00

          SHA512

          36fd1564b93f0dc73809ac5e4963766986932394fed9e0c33d8216132c8947ea560042ac21ff452298e5147b0b2513f1cbac6e7db1fe243d07f1e131c027a757

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l8054180.exe

          Filesize

          168KB

          MD5

          552d1669d62cbb55067b5cd95e6f8180

          SHA1

          10459cfb70045704f86f107e4e90a160a4276733

          SHA256

          ea495e75d19e92b6402f6555707710badc2ca3e4d8dfb73ef15b8d12cd23db4b

          SHA512

          492bac6745f3341e00f10cb63edd1bec548c12739de3988ef08fffd78ac3c9b71a0f4d7c339d926dc13e35b191b6f16eb7684b30a02b1d9c7605b2b037790e6d

        • memory/652-47-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/652-32-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-17-0x0000000004A90000-0x0000000005034000-memory.dmp

          Filesize

          5.6MB

        • memory/652-18-0x0000000005080000-0x0000000005098000-memory.dmp

          Filesize

          96KB

        • memory/652-34-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-46-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-45-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-42-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-19-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-38-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-36-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-24-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-22-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-15-0x00000000049F0000-0x0000000004A0A000-memory.dmp

          Filesize

          104KB

        • memory/652-16-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/652-48-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/652-40-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-20-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-30-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-28-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-26-0x0000000005080000-0x0000000005092000-memory.dmp

          Filesize

          72KB

        • memory/652-49-0x000000007494E000-0x000000007494F000-memory.dmp

          Filesize

          4KB

        • memory/652-50-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/652-52-0x0000000074940000-0x00000000750F0000-memory.dmp

          Filesize

          7.7MB

        • memory/652-14-0x000000007494E000-0x000000007494F000-memory.dmp

          Filesize

          4KB

        • memory/1512-56-0x0000000000090000-0x00000000000BE000-memory.dmp

          Filesize

          184KB

        • memory/1512-57-0x0000000000910000-0x0000000000916000-memory.dmp

          Filesize

          24KB

        • memory/1512-58-0x0000000005030000-0x0000000005648000-memory.dmp

          Filesize

          6.1MB

        • memory/1512-59-0x0000000004B20000-0x0000000004C2A000-memory.dmp

          Filesize

          1.0MB

        • memory/1512-60-0x0000000004A10000-0x0000000004A22000-memory.dmp

          Filesize

          72KB

        • memory/1512-61-0x0000000004A70000-0x0000000004AAC000-memory.dmp

          Filesize

          240KB

        • memory/1512-62-0x0000000004AC0000-0x0000000004B0C000-memory.dmp

          Filesize

          304KB